CSRF protection works.